VULNERABILITY INTELLIGENCE
CVE-2026-80201
CVSS score2 LOW
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-08-26
Last modified2026-10-08
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered invoice output.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')